Use private endpoints with Azure Cache for Redis

September 20, 2025 ยท View on GitHub

SYNOPSIS

Redis cache should disable public network access.

DESCRIPTION

When using Azure Cache for Redis, you can configure the cache to be private or accessible from the public Internet. By default, the cache is configured to be accessible from the public Internet.

To limit network access to the cache you can use firewall rules or private endpoints. Using private endpoints with Azure Cache for Redis is the recommend approach for most scenarios.

Use private endpoints to improve the security posture of your Redis cache and reduce the risk of data breaches.

A private endpoint provides secure and private connectivity to Redis instances by:

  • Using a private IP address from your VNET.
  • Blocking all traffic from public networks.

If you are using VNET injection, it is recommended to migrate to private endpoints.

RECOMMENDATION

Consider using private endpoints to limit network connectivity to the cache and help reduce data exfiltration risks.

EXAMPLES

Configure with Bicep

To deploy caches that pass this rule:

  • Set the properties.publicNetworkAccess property to Disabled.

For example:

resource cache 'Microsoft.Cache/redis@2024-11-01' = {
  name: name
  location: location
  properties: {
    redisVersion: '6'
    sku: {
      name: 'Premium'
      family: 'P'
      capacity: 1
    }
    redisConfiguration: {
      'aad-enabled': 'True'
      'maxmemory-reserved': '615'
    }
    enableNonSslPort: false
    publicNetworkAccess: 'Disabled'
    disableAccessKeyAuthentication: true
  }
  zones: [
    '1'
    '2'
    '3'
  ]
}

Configure with Azure template

To deploy caches that pass this rule:

  • Set the properties.publicNetworkAccess property to Disabled.

For example:

{
  "type": "Microsoft.Cache/redis",
  "apiVersion": "2024-11-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "properties": {
    "redisVersion": "6",
    "sku": {
      "name": "Premium",
      "family": "P",
      "capacity": 1
    },
    "redisConfiguration": {
      "aad-enabled": "True",
      "maxmemory-reserved": "615"
    },
    "enableNonSslPort": false,
    "publicNetworkAccess": "Disabled",
    "disableAccessKeyAuthentication": true
  },
  "zones": [
    "1",
    "2",
    "3"
  ]
}